[lvc-project] [PATCH 6.12 2/2] block: bio-integrity: fix memory leak in bio_integrity_map_user()

[Dmitry Antipov]

Since 'iov_iter_extract_pages()' may allocate new array of pages
even when it returns non-zero error value, matching cleanup with
'vfree()' should be performed on all return paths afterwards. So
adjust 'bio_integrity_map_user()' to ensure that both 'pages' and
'bvec' arrays are always freed on return.

Fixes: 492c5d455969 ("block: bio-integrity: directly map user buffers")
Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
---
 block/bio-integrity.c | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index 6641ecbf6967..f788a9ba1f38 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -338,11 +338,9 @@ int bio_integrity_map_user(struct bio *bio, void __user *ubuf, ssize_t bytes,
 	copy = !iov_iter_is_aligned(&iter, align, align);
 	ret = iov_iter_extract_pages(&iter, &pages, bytes, nr_vecs, 0, &offset);
 	if (unlikely(ret < 0))
-		goto free_bvec;
+		goto out_free;
 
 	nr_bvecs = bvec_from_pages(bvec, pages, nr_vecs, bytes, offset);
-	if (pages != stack_pages)
-		kvfree(pages);
 	if (nr_bvecs > queue_max_integrity_segments(q))
 		copy = true;
 
@@ -352,15 +350,11 @@ int bio_integrity_map_user(struct bio *bio, void __user *ubuf, ssize_t bytes,
 	else
 		ret = bio_integrity_init_user(bio, bvec, nr_bvecs, bytes, seed);
 	if (ret)
-		goto release_pages;
-	if (bvec != stack_vec)
-		kfree(bvec);
-
-	return 0;
+		bio_integrity_unpin_bvec(bvec, nr_bvecs);
+out_free:
+	if (pages != stack_pages)
+		kvfree(pages);
 
-release_pages:
-	bio_integrity_unpin_bvec(bvec, nr_bvecs);
-free_bvec:
 	if (bvec != stack_vec)
 		kfree(bvec);
 	return ret;
-- 
2.54.0